Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    600s
  • max time network
    597s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/08/2024, 07:20

General

  • Target

    build.exe

  • Size

    7.1MB

  • MD5

    03b4a7f20fdad6d69d148a3426b499af

  • SHA1

    29c2f0d4a32776ba00c8dd882d35fdbfaec343ad

  • SHA256

    54ec62ac33637ed3bf49e914bfb9e5245e12fbebfb91e44705cd08b29e05b59c

  • SHA512

    a2ba94f54a34a6e40d312ad63d71dec427ee3a80f300e97381f9541a6ac3fb67bc7095df38e045d088c893e92cc24058a93e02d9087c963cfbf1f6baf02c0b78

  • SSDEEP

    196608:B/4iA3qoIyI47/Q3D+h6Pkvct9GcemuYX:B/3AaZDQ/Q3D+hEkUacxX

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Creates new service(s) 2 TTPs
  • Stops running service(s) 4 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs

    Clear Windows Event Logs to hide the activity of an intrusion.

  • Drops file in System32 directory 14 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Checks SCSI registry key(s) 3 TTPs 18 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies data under HKEY_USERS 63 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:612
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:316
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:668
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
        1⤵
          PID:952
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
          1⤵
            PID:508
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
            1⤵
              PID:436
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
              1⤵
                PID:1044
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                1⤵
                  PID:1068
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                  1⤵
                    PID:1200
                    • C:\Windows\system32\taskhostw.exe
                      taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                      2⤵
                        PID:3152
                    • C:\Windows\System32\svchost.exe
                      C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                      1⤵
                      • Indicator Removal: Clear Windows Event Logs
                      PID:1232
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                      1⤵
                        PID:1308
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                        1⤵
                          PID:1316
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                          1⤵
                            PID:1340
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                            1⤵
                              PID:1472
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                              1⤵
                                PID:1480
                              • C:\Windows\System32\svchost.exe
                                C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                1⤵
                                  PID:1504
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                                  1⤵
                                    PID:1540
                                    • C:\Windows\system32\sihost.exe
                                      sihost.exe
                                      2⤵
                                        PID:1372
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                      1⤵
                                        PID:1668
                                      • C:\Windows\System32\svchost.exe
                                        C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                        1⤵
                                          PID:1712
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                          1⤵
                                            PID:1752
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                            1⤵
                                              PID:1824
                                            • C:\Windows\System32\svchost.exe
                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                              1⤵
                                                PID:1832
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                1⤵
                                                  PID:1920
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                  1⤵
                                                    PID:1928
                                                  • C:\Windows\System32\svchost.exe
                                                    C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                    1⤵
                                                      PID:1992
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                      1⤵
                                                        PID:2000
                                                      • C:\Windows\System32\spoolsv.exe
                                                        C:\Windows\System32\spoolsv.exe
                                                        1⤵
                                                          PID:1732
                                                        • C:\Windows\System32\svchost.exe
                                                          C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                          1⤵
                                                            PID:2172
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                            1⤵
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:2216
                                                          • C:\Windows\System32\svchost.exe
                                                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                            1⤵
                                                              PID:2300
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                              1⤵
                                                                PID:2368
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                                1⤵
                                                                  PID:2376
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                  1⤵
                                                                  • Drops file in System32 directory
                                                                  PID:2448
                                                                • C:\Windows\sysmon.exe
                                                                  C:\Windows\sysmon.exe
                                                                  1⤵
                                                                    PID:2456
                                                                  • C:\Windows\System32\svchost.exe
                                                                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                    1⤵
                                                                      PID:2476
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                      1⤵
                                                                        PID:2484
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                        1⤵
                                                                          PID:2600
                                                                        • C:\Windows\system32\wbem\unsecapp.exe
                                                                          C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                          1⤵
                                                                            PID:2900
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                            1⤵
                                                                              PID:800
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                              1⤵
                                                                                PID:3216
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                1⤵
                                                                                  PID:3356
                                                                                • C:\Windows\Explorer.EXE
                                                                                  C:\Windows\Explorer.EXE
                                                                                  1⤵
                                                                                  • Suspicious use of UnmapMainImage
                                                                                  PID:3432
                                                                                  • C:\Users\Admin\AppData\Local\Temp\build.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\build.exe"
                                                                                    2⤵
                                                                                    • Drops file in System32 directory
                                                                                    • Suspicious use of SetThreadContext
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:2320
                                                                                    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                      3⤵
                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:1080
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                      3⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:824
                                                                                      • C:\Windows\system32\wusa.exe
                                                                                        wusa /uninstall /kb:890830 /quiet /norestart
                                                                                        4⤵
                                                                                          PID:3008
                                                                                      • C:\Windows\system32\sc.exe
                                                                                        C:\Windows\system32\sc.exe stop UsoSvc
                                                                                        3⤵
                                                                                        • Launches sc.exe
                                                                                        PID:3208
                                                                                      • C:\Windows\system32\sc.exe
                                                                                        C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                        3⤵
                                                                                        • Launches sc.exe
                                                                                        PID:4652
                                                                                      • C:\Windows\system32\sc.exe
                                                                                        C:\Windows\system32\sc.exe stop wuauserv
                                                                                        3⤵
                                                                                        • Launches sc.exe
                                                                                        PID:3832
                                                                                      • C:\Windows\system32\sc.exe
                                                                                        C:\Windows\system32\sc.exe stop bits
                                                                                        3⤵
                                                                                        • Launches sc.exe
                                                                                        PID:3836
                                                                                      • C:\Windows\system32\sc.exe
                                                                                        C:\Windows\system32\sc.exe stop dosvc
                                                                                        3⤵
                                                                                        • Launches sc.exe
                                                                                        PID:2892
                                                                                      • C:\Windows\system32\dialer.exe
                                                                                        C:\Windows\system32\dialer.exe
                                                                                        3⤵
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:5004
                                                                                      • C:\Windows\system32\sc.exe
                                                                                        C:\Windows\system32\sc.exe delete "ZPGRVBPA"
                                                                                        3⤵
                                                                                        • Launches sc.exe
                                                                                        PID:3076
                                                                                      • C:\Windows\system32\sc.exe
                                                                                        C:\Windows\system32\sc.exe create "ZPGRVBPA" binpath= "C:\ProgramData\gauhbkggpybj\yrzhndhoiexf.exe" start= "auto"
                                                                                        3⤵
                                                                                        • Launches sc.exe
                                                                                        PID:740
                                                                                      • C:\Windows\system32\sc.exe
                                                                                        C:\Windows\system32\sc.exe stop eventlog
                                                                                        3⤵
                                                                                        • Launches sc.exe
                                                                                        PID:4160
                                                                                      • C:\Windows\system32\sc.exe
                                                                                        C:\Windows\system32\sc.exe start "ZPGRVBPA"
                                                                                        3⤵
                                                                                        • Launches sc.exe
                                                                                        PID:3264
                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          4⤵
                                                                                            PID:5064
                                                                                    • C:\Windows\system32\svchost.exe
                                                                                      C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                      1⤵
                                                                                        PID:3552
                                                                                      • C:\Windows\system32\DllHost.exe
                                                                                        C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                        1⤵
                                                                                          PID:3724
                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                          1⤵
                                                                                          • Suspicious use of UnmapMainImage
                                                                                          PID:3888
                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                          1⤵
                                                                                            PID:4084
                                                                                          • C:\Windows\System32\RuntimeBroker.exe
                                                                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                            1⤵
                                                                                              PID:2588
                                                                                            • C:\Windows\System32\svchost.exe
                                                                                              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                              1⤵
                                                                                                PID:408
                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                1⤵
                                                                                                  PID:2180
                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                  1⤵
                                                                                                  • Modifies data under HKEY_USERS
                                                                                                  PID:3988
                                                                                                • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                  "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                  1⤵
                                                                                                  • Drops file in System32 directory
                                                                                                  • Modifies data under HKEY_USERS
                                                                                                  PID:1612
                                                                                                • C:\Windows\system32\SppExtComObj.exe
                                                                                                  C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                  1⤵
                                                                                                    PID:4236
                                                                                                  • C:\Windows\System32\svchost.exe
                                                                                                    C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                    1⤵
                                                                                                      PID:4908
                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                      1⤵
                                                                                                        PID:4496
                                                                                                      • C:\Windows\system32\DllHost.exe
                                                                                                        C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                        1⤵
                                                                                                          PID:4400
                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                          1⤵
                                                                                                            PID:1088
                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
                                                                                                            1⤵
                                                                                                              PID:3796
                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                              C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
                                                                                                              1⤵
                                                                                                                PID:4724
                                                                                                              • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                1⤵
                                                                                                                  PID:4212
                                                                                                                • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                  C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                  1⤵
                                                                                                                  • Modifies registry class
                                                                                                                  PID:4992
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                                  1⤵
                                                                                                                  • Drops file in Windows directory
                                                                                                                  PID:4792
                                                                                                                • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                  C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                  1⤵
                                                                                                                  • Checks BIOS information in registry
                                                                                                                  • Checks SCSI registry key(s)
                                                                                                                  • Checks processor information in registry
                                                                                                                  • Enumerates system info in registry
                                                                                                                  PID:3044
                                                                                                                • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                  C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                  1⤵
                                                                                                                    PID:2976
                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                                    1⤵
                                                                                                                      PID:3316
                                                                                                                    • C:\Windows\System32\mousocoreworker.exe
                                                                                                                      C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                      1⤵
                                                                                                                        PID:4344
                                                                                                                      • C:\ProgramData\gauhbkggpybj\yrzhndhoiexf.exe
                                                                                                                        C:\ProgramData\gauhbkggpybj\yrzhndhoiexf.exe
                                                                                                                        1⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in System32 directory
                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:852
                                                                                                                        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                          2⤵
                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                          • Drops file in System32 directory
                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:4636
                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                            3⤵
                                                                                                                              PID:5088
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                            2⤵
                                                                                                                              PID:788
                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                3⤵
                                                                                                                                  PID:2988
                                                                                                                                • C:\Windows\system32\wusa.exe
                                                                                                                                  wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                  3⤵
                                                                                                                                    PID:2948
                                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                                  C:\Windows\system32\sc.exe stop UsoSvc
                                                                                                                                  2⤵
                                                                                                                                  • Launches sc.exe
                                                                                                                                  PID:4848
                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                    3⤵
                                                                                                                                      PID:4352
                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                    C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                                                                    2⤵
                                                                                                                                    • Launches sc.exe
                                                                                                                                    PID:3836
                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                    C:\Windows\system32\sc.exe stop wuauserv
                                                                                                                                    2⤵
                                                                                                                                    • Launches sc.exe
                                                                                                                                    PID:2136
                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                    C:\Windows\system32\sc.exe stop bits
                                                                                                                                    2⤵
                                                                                                                                    • Launches sc.exe
                                                                                                                                    PID:1020
                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                    C:\Windows\system32\sc.exe stop dosvc
                                                                                                                                    2⤵
                                                                                                                                    • Launches sc.exe
                                                                                                                                    PID:3672
                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                      3⤵
                                                                                                                                        PID:1176
                                                                                                                                    • C:\Windows\system32\dialer.exe
                                                                                                                                      C:\Windows\system32\dialer.exe
                                                                                                                                      2⤵
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:1148
                                                                                                                                    • C:\Windows\system32\dialer.exe
                                                                                                                                      C:\Windows\system32\dialer.exe
                                                                                                                                      2⤵
                                                                                                                                        PID:3936
                                                                                                                                      • C:\Windows\system32\dialer.exe
                                                                                                                                        dialer.exe
                                                                                                                                        2⤵
                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                        PID:4436
                                                                                                                                    • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
                                                                                                                                      C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
                                                                                                                                      1⤵
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      PID:3664
                                                                                                                                    • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                                      "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                                                                      1⤵
                                                                                                                                        PID:752
                                                                                                                                      • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                                        "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                                                                        1⤵
                                                                                                                                          PID:3836
                                                                                                                                        • C:\Windows\system32\BackgroundTransferHost.exe
                                                                                                                                          "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                                                                                                                                          1⤵
                                                                                                                                            PID:2708
                                                                                                                                          • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                            1⤵
                                                                                                                                              PID:5108

                                                                                                                                            Network

                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                            Replay Monitor

                                                                                                                                            Loading Replay Monitor...

                                                                                                                                            Downloads

                                                                                                                                            • C:\ProgramData\gauhbkggpybj\yrzhndhoiexf.exe

                                                                                                                                              Filesize

                                                                                                                                              7.1MB

                                                                                                                                              MD5

                                                                                                                                              03b4a7f20fdad6d69d148a3426b499af

                                                                                                                                              SHA1

                                                                                                                                              29c2f0d4a32776ba00c8dd882d35fdbfaec343ad

                                                                                                                                              SHA256

                                                                                                                                              54ec62ac33637ed3bf49e914bfb9e5245e12fbebfb91e44705cd08b29e05b59c

                                                                                                                                              SHA512

                                                                                                                                              a2ba94f54a34a6e40d312ad63d71dec427ee3a80f300e97381f9541a6ac3fb67bc7095df38e045d088c893e92cc24058a93e02d9087c963cfbf1f6baf02c0b78

                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                                                                                                                                              Filesize

                                                                                                                                              328B

                                                                                                                                              MD5

                                                                                                                                              25fb8f3a8981123840fecd52bd1051ea

                                                                                                                                              SHA1

                                                                                                                                              fa510730d597756368f6ba962c60ee37a027cfe2

                                                                                                                                              SHA256

                                                                                                                                              f21d0bd2fa7f091d0165464efe20b7877f6ce7d156dc1b160690c21a76d00ebb

                                                                                                                                              SHA512

                                                                                                                                              646d3d1d11fea8b9b475584e47f55399622a6a97990b4b9e5dedfd05127af9b792ee7939b0895cccebbc58d6801cac125b378c6a6f4f805406f722831fd4e35b

                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749

                                                                                                                                              Filesize

                                                                                                                                              330B

                                                                                                                                              MD5

                                                                                                                                              fa22169375708ad19aa4e31bd67cabd4

                                                                                                                                              SHA1

                                                                                                                                              ba56c3005e29711a833fc80158e3e1e232844a9c

                                                                                                                                              SHA256

                                                                                                                                              c86fe3e09a6664dd215dcb46d029271ed07f0509b13ff56d45716f3bdbf589e5

                                                                                                                                              SHA512

                                                                                                                                              16a30e69cd3a943a279f9a4e02da4e24bbb02639a786a6ca8a2501544e9934a1329a27c89e8991274a543f998996b6cc2c4c220ebedb0cb503beb372977db002

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_e4ykgucx.wpt.ps1

                                                                                                                                              Filesize

                                                                                                                                              60B

                                                                                                                                              MD5

                                                                                                                                              d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                              SHA1

                                                                                                                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                              SHA256

                                                                                                                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                              SHA512

                                                                                                                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                            • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                                                                                                                                              Filesize

                                                                                                                                              328B

                                                                                                                                              MD5

                                                                                                                                              a976a3fa05608ab892854093744054d5

                                                                                                                                              SHA1

                                                                                                                                              9e5b42d0d3f32c46245e1acd6201d13797ed5ce0

                                                                                                                                              SHA256

                                                                                                                                              d513b1321cb68bde01d44b2339ff3c50e12d3502a740254324ae6d46d5c21241

                                                                                                                                              SHA512

                                                                                                                                              eb60436634c6e9300db9f82754e5d4b57a4e84cc7e4d2f497f53b4516554200c154066f5b4c35389bdc8cdb53e976d5c17e1ce97fe820315074a5ba7c78e9df2

                                                                                                                                            • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749

                                                                                                                                              Filesize

                                                                                                                                              330B

                                                                                                                                              MD5

                                                                                                                                              62314b71e6093cdc86b0fa51892d53bc

                                                                                                                                              SHA1

                                                                                                                                              cc82cf6f04ec81b446850f2dde51040542a244b1

                                                                                                                                              SHA256

                                                                                                                                              6ec14adc8de91d835433cb3fda94dae646331886ccd31ef6ba4f2a78c94d986d

                                                                                                                                              SHA512

                                                                                                                                              318590b16f37a0f5150a8e1426b88e0ac97654ed060db7dcdc3cb5ab5d3c4cb582721d3c3504f1bb76c243859858dbd63472808841ecda74429e1e06b43288e4

                                                                                                                                            • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

                                                                                                                                              Filesize

                                                                                                                                              412B

                                                                                                                                              MD5

                                                                                                                                              fa73515f240dcb60960a9889ec759521

                                                                                                                                              SHA1

                                                                                                                                              b335b69a4fdbab59bc9297c5689a48d339bb43bf

                                                                                                                                              SHA256

                                                                                                                                              54df79cefdd2e087f08d7a88521229a4f73c143bb998eef6749f18373803ad9e

                                                                                                                                              SHA512

                                                                                                                                              a0d0676eb61abe30c7e472ee2e9582930b817b314d6fb56525f41ffcd87074bd81856e9618a0719fd346490ed8ca6807d24cbcfcdc88fee820c5be5c95aa9619

                                                                                                                                            • memory/316-34-0x0000016D4ADA0000-0x0000016D4ADCB000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              172KB

                                                                                                                                            • memory/316-35-0x00007FFA58C50000-0x00007FFA58C60000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/436-53-0x00007FFA58C50000-0x00007FFA58C60000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/436-52-0x00000194D6B60000-0x00000194D6B8B000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              172KB

                                                                                                                                            • memory/508-44-0x0000023B5F900000-0x0000023B5F92B000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              172KB

                                                                                                                                            • memory/508-45-0x00007FFA58C50000-0x00007FFA58C60000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/612-37-0x0000024DCA6C0000-0x0000024DCA6EB000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              172KB

                                                                                                                                            • memory/612-38-0x00007FFA58C50000-0x00007FFA58C60000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/668-28-0x000001E2ED070000-0x000001E2ED094000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              144KB

                                                                                                                                            • memory/668-30-0x00007FFA58C50000-0x00007FFA58C60000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/668-29-0x000001E2ED0A0000-0x000001E2ED0CB000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              172KB

                                                                                                                                            • memory/952-41-0x00000256B05F0000-0x00000256B061B000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              172KB

                                                                                                                                            • memory/952-42-0x00007FFA58C50000-0x00007FFA58C60000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/1044-55-0x000001C013B70000-0x000001C013B9B000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              172KB

                                                                                                                                            • memory/1044-56-0x00007FFA58C50000-0x00007FFA58C60000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/1068-59-0x00007FFA58C50000-0x00007FFA58C60000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/1068-58-0x000001C4DA370000-0x000001C4DA39B000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              172KB

                                                                                                                                            • memory/1080-0-0x00007FFA7A473000-0x00007FFA7A475000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              8KB

                                                                                                                                            • memory/1080-12-0x00007FFA7A470000-0x00007FFA7AF31000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              10.8MB

                                                                                                                                            • memory/1080-6-0x0000017429F20000-0x0000017429F42000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              136KB

                                                                                                                                            • memory/1080-11-0x00007FFA7A470000-0x00007FFA7AF31000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              10.8MB

                                                                                                                                            • memory/1080-15-0x00007FFA7A470000-0x00007FFA7AF31000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              10.8MB

                                                                                                                                            • memory/1200-61-0x000001A988860000-0x000001A98888B000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              172KB

                                                                                                                                            • memory/1200-62-0x00007FFA58C50000-0x00007FFA58C60000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/1232-65-0x00007FFA58C50000-0x00007FFA58C60000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/1232-64-0x000002AE6C6E0000-0x000002AE6C70B000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              172KB

                                                                                                                                            • memory/1308-68-0x000002158DB90000-0x000002158DBBB000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              172KB

                                                                                                                                            • memory/1308-69-0x00007FFA58C50000-0x00007FFA58C60000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/1316-79-0x0000026ADE8D0000-0x0000026ADE8FB000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              172KB

                                                                                                                                            • memory/4636-340-0x0000021066D10000-0x0000021066D2C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              112KB

                                                                                                                                            • memory/4636-346-0x0000021066F40000-0x0000021066F48000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              32KB

                                                                                                                                            • memory/4636-348-0x0000021066F80000-0x0000021066F8A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              40KB

                                                                                                                                            • memory/4636-347-0x0000021066F70000-0x0000021066F76000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              24KB

                                                                                                                                            • memory/4636-341-0x0000021066D30000-0x0000021066DE5000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              724KB

                                                                                                                                            • memory/4636-342-0x0000021066010000-0x000002106601A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              40KB

                                                                                                                                            • memory/4636-343-0x0000021066F50000-0x0000021066F6C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              112KB

                                                                                                                                            • memory/4636-344-0x0000021066F30000-0x0000021066F3A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              40KB

                                                                                                                                            • memory/4636-345-0x0000021066F90000-0x0000021066FAA000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              104KB

                                                                                                                                            • memory/5004-24-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              172KB

                                                                                                                                            • memory/5004-22-0x00007FFA98BD0000-0x00007FFA98DC5000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              2.0MB

                                                                                                                                            • memory/5004-23-0x00007FFA97300000-0x00007FFA973BE000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              760KB

                                                                                                                                            • memory/5004-18-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              172KB

                                                                                                                                            • memory/5004-20-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              172KB

                                                                                                                                            • memory/5004-21-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              172KB

                                                                                                                                            • memory/5004-17-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              172KB

                                                                                                                                            • memory/5004-16-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              172KB